Bosses are overoptimistic about cybercrime
Crooks target all sorts of organisations
Who ever heard of criminal raid on a university? Men in balaclavas jumping out of a van to blow open the safe? I've never read about anything like that in the news, or seen it depicted in a crime drama. I associate raids like that with banks, jewellers and art galleries, as in The Italian Job or the Raffles books.
Please transfer two hundred grand
How to recognise, prevent and respond to CEO fraud
Our brand name is being used by internet crooks! What can we do?
All sectors vulnerable to cybercrime
So it's no surprise that a university vice-chancellor gives less thought to physical security than the CEO of a bank. For a long time, it was the same where cybercrime was concerned: it was mainly banks and other financial service providers that had to worry about phishing mail, fake websites and other e-scams. Managers in other sectors and smaller organisations weren't really affected. But things have changed.
Crooks want more than cash, gems and fine art
Unfortunately for people like university vice-chancellors, cybercrooks have widened their sights in recent years. They work to very different criteria than traditional gangsters. Nowadays, your organisation doesn't have to handle cash, gems or fine art to be an attractive target. That was emphasised by recent reports about Iranian hackers trying to steal Dutch scientific research. Sectors that have little to entice an old-fashioned robber can be full of opportunity for the cybercrook.
Education sector is particularly attractive
People working in such sectors often realise the risk only when there's an incident involving a very similar organisation to their own. No doubt the recent ransomware attack on the Maastricht University will have set alarm bells ringing amongst senior academic administrators far and wide. Yet the Maastricht incident was certainly not the first of its kind: the University of Calgary in Canada was hit by a similar heist in 2016. Indeed, in the same year multiple studies found that the education sector was the most popular target for ransomware distributors.
Optimism bias impedes cybersecurity
The strength of the shockwaves reverberating around the university sector following events in Maastricht is partly down to 'optimism bias', a term used by psychologists to describe the tendency to assume that a negative event won't occur. Only when the risk manifests itself close to home is optimism displaced by a sense of urgency: something must be done, and done now. The optimism bias phenomenon is a serious brake on efforts to fight cybercrime.
Identifying lookalike domain names
Here at SIDN, we often witness the switch from optimism to urgency when cybercrooks abuse domain names to attack an organisation. Following a well publicised incident, people working in the same sector get in touch to ask us how they can quickly identify domain names that look like their own. We usually point them to SIDN BrandGuard. The pattern repeats itself every time a particular industry is hit by a high-profile scam or heist.
It pays to look further afield
My main advice to security specialists, CISOs and top managers is, therefore, look outside your own immediate surroundings. Talk to your counterparts in other industries and use a Google Alert to get news of relevant incidents abroad (e.g. a search on 'cybercrime in education'). Senior executives would also do well to make sure cybercrime is an explicit item on their organisations' agendas and not forever subordinated to everyday operational issues.
